Permission denied errors — page 3
Issues 401–600 of the 2,858 matching this topic. The trend chart and topic overview are on page 1.
- [BUG] Desktop: MCP widgets have no working export path — "Copy to clipboard" fails with cloud-only advice, "Download file" silently no-ops
- [BUG] Cowork /sessions never garbage-collects session directories (2,328 stale dirs, disk at 100%, unrecoverable from sandbox)
- Sandboxed commands can't reach the macOS keychain, and the tools that need it blame the credential
- MCP OAuth loopback redirect uses 127.0.0.1 instead of localhost — breaks providers (e.g. Salesforce) that only allow localhost callback URLs
- [BUG] macOS sandbox blocks Chromium/Playwright launch: bootstrap_check_in denied — no mach-register allowance exists, allowMachLookup cannot help
- Sandbox masks nonexistent deny-listed paths as unreadable device nodes - breaks plain git whenever `extensions.worktreeConfig` is enabled
- [BUG] Context usage percentage computed against 200K while session actually runs with 1M context ([1m] model variant)
- EPERM error after update to 2.1.193
- [FEATURE] Support wildcard/regex for `sandbox.network.allowUnixSockets` on macOS
- [DOCS] Sandbox docs omit `sandbox.credentials` setting added in v2.1.187
- WorktreeCreate hook fails with EPERM for repos under ~/Documents — hook spawned via 'disclaimer' shim loses the app's TCC Documents grant
- Support skipping GCP auth in Vertex AI mode for proxy-based deployments
- [BUG] Cowork sandbox VM bundle not found in Roaming path on Windows 10 Pro (Store/AppX install) — hardlink workaround
- MCP sandbox egress: allow <us2.make.com>
- [BUG] Sandbox blocks writes to `.vscode/` and `.idea/` inside `node_modules/`, breaking `pnpm install`
- [BUG] Critical: sandbox.filesystem.denyRead does not prevent credential exposure
- Claude-3p + Bedrock: managed-settings allowedDomains not honored, sandbox pinned to 4 hosts
- Catastrophic data loss from `cmd /c rd /s /q` via PowerShell tool with broken quoting on Unicode/space path
- [BUG] Routines /run endpoint returns HTTP 400 "trigger_id: Extra inputs are not permitted" — both web UI and RemoteTrigger tool affected
- [BUG] Sandbox startup error on Linux shows unrendered `${j$}` instead of the failing sandbox component
- [BUG] v2.1.120 — (fix inside) ERROR g9H is not a function. (In 'g9H(K)', 'g9H' is undefined)
- [BUG] Cowork/Workspace EXDEV: cross-device link not permitted on Windows 11 — rootfs.vhdx rename fails
- Worktree UX: session keying, multi-repo isolation, and gitignored files
- Bash tool silently returns empty output when `/tmp/claude-$UID/` exceeds tmpfs quota
- [BUG] Continuously getting API Error: 400 {"error":{"message":"{"message":"context_management: Extra inputs are not permitted"}. Received Model Group=bedrock-sonnet-4.5\nAvailable Model Group Fallbacks=None","type":"None","param":"None","code":"400"}}
- [BUG] Sandbox fails inside Docker containers: nested user namespace in apply-seccomp causes EACCES on /proc/self/setgroups
- Managed Agents: gmail.googleapis.com blocked by egress proxy even with explicit allowed_hosts
- Cowork: launch virtiofsd with cache=none on workspace mounts to fix stale .git/index.lock
- Ultraplan remote session offers 'implement here' but cannot push code
- [BUG] Cowork VM guest connection timeout on Windows 10 Pro — 60s timeout too short for HDD systems, Linux guest stalls after add_plan9_shares
- [DOCS] PowerShell docs omit key permission-check behavior
- [Bug] Claude Opus Max performance degradation in code generation quality
- Edit/Write tools fail with EPERM on Windows drive root paths (e.g. D:\)
- sandbox.network.allowedDomains does not work for Node.js processes (DNS resolution blocked)
- [Bug] Escape key not working in /status submenu on Ubuntu
- Sandbox silently disabled when ripgrep not installed — no warning to user
- [BUG] Pipes silently broken in sandbox: shell-quoted "<" in oAD passes literal argument to eval instead of redirect
- Git worktrees of the same repo share the same project identity, causing cross-worktree path confusion
- [BUG] plugin install / marketplace add silently clears sandbox.filesystem configuration
- Windows: .claude.json corruption from concurrent writes causes repeated OAuth login
- Claude in Chrome: Extension crashes when executing javascript_tool or read_page on certain pages
- [FEATURE] Cowork: Allow folder selection outside home directory (custom allowed paths)
- Subagents cannot use Bash despite parent Bash(*) allow rule
- Sandbox filesystem allowlist doesn't resolve symlinks, causing "Operation not permitted" for Bash tools
- [BUG] Sandbox CWD tracking uses CLAUDE_CODE_TMPDIR which is not in sandbox allow list
- [Bug] rm -rf command deletes unintended parent directory contents
- Sandbox creates phantom dotfiles in project directory instead of protecting home directory files
- URGENT: My claude.code terminal crashed again: Usafe limits exhaused.. 2.1.2 is totally unstable
- [BUG] Sandbox permission error after update: EACCES permission denied mkdir /tmp/claude/.../tasks
- [BUG] `/sandbox` Sandbox mode is useless
- spawn pgrep ENOENT crash on macOS
- [MODEL] "Do you want to make this edit to....." --> overwhelming repetitive prompts after "2.Yes,allow...."
- [DOCS] Comprehensive Documentation Update for Claude Code v2.0.0 Release
- [Bug] Security Vulnerability: Permissions Bypass via ExitPlanMode Workflow Exploit
- Low Context Management in Claude Code CLI
- [Feature Request] Allow a user to specify an arbitrary command prepended to every bash command.
- Installation Failure on Windows - Unsupported OS Error
- bridge-spawn root ignores CLAUDE_CONFIG_DIR and always creates ~/.claude
- [BUG] Merged Home: chat threads and Cowork sessions coexist in one project with different capabilities and no visible mode indicator
- [BUG] Mid-input slash completion never matches plugin-namespaced skills (plugin:skill), while the position-0 dropdown does
- [BUG] Session working directory becomes permanently unresolvable after using a git worktree (background job), breaking Bash, file tools, and the /cd command
- [BUG] Cloud environment setup script gets HTTP 503 through the security proxy; the identical curl succeeds when the agent runs it in-session
- Sandbox fails to arm: apply-seccomp setgroups EPERM in initial userns unless allowAllUnixSockets:true (2.1.220)
- Background auto-mode sessions execute Bash calls matching ask rules (and PreToolUse hook ask decisions) without any prompt (2.1.215)
- [BUG] Windows sandbox breaks Gradle/JVM loopback IPC ("Unable to establish loopback connection") — still repros on 2.1.209 (#44857 closed without fix)
- [BUG] Windows MSIX/Cowork: in-app Claude Code writes silently virtualized (succeed but don't persist), and in-place updates deadlock on the Cowork VM service's file handles
- [FEATURE] Multi-dimensional / scientific data visualization in Claude Code (charts, plots, heatmaps — beyond Mermaid)
- [BUG] Asked permission to run `cd /x/y/z && rm -rf *` in "bypass permissions" mode.
- Regression (2.1.195 → 2.1.196): background daemon transient-spawn fails over SSH on macOS — "Could not switch to audit session: Operation not permitted"
- SSH sessions: history blank and fork fails due to tail connecting via raw IP instead of SSH config alias
- [Bug] Tool-call markup leaks into assistant text after large context accumulation
- [BUG] Claude Managed Agent internal proxy throwing 503 when interacting with Git
- [FEATURE] VS Code extension: cap chat panel max-width for readability on wide displays
- [Bug] Linked worktree sandbox auto-allow missing main .git directory and denyWithinAllow paths off-by-one
- Plan mode should enforce read-only at the tool layer, not via LLM instruction
- macOS: "'2.x.xxx' would like to access data from other apps" prompt on every launch
- remote-control 2.1.138 regression: pre-create-session POST returns 400 "Extra inputs are not permitted", phone work-dispatch silently broken
- [Bug] filesystem.denyRead not merged with Read(...) deny permissions in sandbox
- Improve sandbox support for erlang / elixir
- [BUG] Cowork: Session init fails to mount scheduled task config folder outside project mount after macOS Desktop upgrade
- [BUG] \u in Windows path is interpreted as Unicode escape sequence, corrupting file paths for usernames starting with u followed by hex digits
- [Bug] Auto mode bypasses manual permission prompt for dangerouslyDisableSandbox commands
- [BUG] [P0] Claude Code Web sandbox produces Docker-incompatible projects that fail outside the sandbox!!!
- [BUG] Write tool bypasses sandbox filesystem write restrictions that Bash tool correctly enforces
- Duplicate detection bot is auto-closing valid issues at scale — 15,240 closures and counting
- [BUG] Paste auth code does not work on v2.1.107 when running claude code in a VM from Mac
- [BUG] Bypassed global settings to read secret keys
- feat: add option to scope /resume to current workspace directory
- [BUG] Sandbox deny rules with mid-path globs cause E2BIG on Linux — per-file bwrap expansion instead of per-directory overlay
- [FEATURE] Enable Ruby 3.4+ in claude code web sandboxes
- Sandbox filesystem rules can't scope to git root, breaking worktree workflows
- [DOCS] Sandboxing network-access prompt flow is outdated for auto mode and bypassPermissions
- Documentation discrepancy: Read(...) deny rules affect Bash tool calls (undocumented behavior)
- [BUG] recent seccomp change for /sandbox broke executing Windows tools from WSL
- permissions.allow in project .claude/settings.json is ignored by VS Code extension
- [BUG] Scheduled remote triggers lost gh CLI access
- You've hit your limit · resets 1am (Europe/London)
- [BUG] sandbox: allowAllUnixSockets does not cover network-bind — tsx and other IPC servers fail with EPERM
- Bug: Sandbox half-broken — writes hit real filesystem, reads sandboxed — destroyed entire project
- [BUG] isolation="worktree" fails on Windows — falsely reports "not in a git repository"
- Plugin system does not preserve execute permission on hook scripts
- [BUG] Plugin .sh files lose execute permission on marketplace update
- [BUG] Cowork "requires a newer installation" on Windows 11 Enterprise 24H2 — yukonSilver unsupported on v1.1.8359.0
- [BUG] Cowork returns 403 on macOS 26.3.1 but works on macOS 26.3
- [BUG] Sandbox blocks CoreSimulator mach-lookup, breaking iOS simulator tests
- [BUG] Windows: Drive Letter Change Triggers Permission Resolver Explosion + Arbitrary .claude/ Directory Creation Outside Workspace
- Voice mode: holding spacebar inserts spaces instead of triggering recording on Linux
- [Bug] Sandbox mode unavailable on macOS - missing platform support
- [BUG] Claude Code sets ~/.claude.json to read-only (444), then hangs on startup because it can't write to it
- [BUG] sandbox Claude Code crashes and OOM-killed by kernel when node_modules exists in project directory
- [BUG] Cowork shows "Virtualization is not enabled" on Windows 11 despite Hyper-V fully enabled (Lenovo ThinkPad)
- [BUG] [Cowork] Windows: EXDEV error on rename during VM bundle setup (EFS-related)
- IDE integration does not work inside Docker Desktop sandboxes
- [BUG] Thinking blocks modification error persists in v2.1.20 (post-Jan 25 fix)
- [Bug] Screen flickering persists in version 2.1.17
- [FEATURE] Use relative path symlink in native installer
- Feature Request: Expose Sandbox Status to Status Line JSON Input
- [BUG] Weekly Limit Not Resetting on time
- Background task fails with EPERM when user lacks write access to drive root
- [BUG] Sandbox debug output contaminating JSON stream in Codespaces
- AWS Bedrock compatibility issue with tools.3.custom.input_examples in v2.0.46
- [BUG] Bash tool error reporting insufficient for chained commands (only "Exit code 1")
- [Bug] Sandbox mode causes 200+ second delay on bash command results
- Path Normalization Failure: Doubled Unix Drive Prefix in Windows Environments
- [BUG] Permission settings unclear/inconsistent - security issues
- [BUG] CRITICAL: Write tool creates files outside working directory on Windows
- Permission denied with aws bedrock but working with aws cli
- [BUG] Project files no longer available on the session disk (/mnt/project) since the 6 October sessions change
- [BUG] Remote Control returns HTTP 403 on the in-session `/bridge` path, while `claude remote-control` works on the same machine and account
- [BUG] Cowork Windows 1.49585.0.0: host attaches Plan9 shares (hr=0x0) and guest sdk-daemon reports ready, but guest mounts nothing — every bash call fails "no Plan9 drive shares mounted under /mnt/.virtiofs-root/shared"; guest console log is 0 bytes
- [BUG] Regression in 2.1.259: managed-settings discovery on WSL fails fatally when /mnt/c is inaccessible (works in 2.1.258)
- [BUG] Cowork browser fallback crashes app, leaves it unable to launch ("This app can't open") — recurs even after reinstall
- CLAUDE_CODE_LOCAL_BINARY override still dead code in Desktop 1.24012.11 (Linux) — initLocalBinary() has no call site; env var is read and discarded
- Cowork sandbox recurring failure — useradd exit 12 / no space left on device (5 recurrences in a week, prior fix didn't hold)
- Cowork sessions can no longer manage local scheduled tasks: scheduled-tasks MCP not exposed to (now remote-executing) desktop sessions, and the Scheduled folder is blocked as a protected location
- [BUG] Cowork sandbox fails at sdk_install on Windows — VM guest crashes with "connection forcibly closed" (regression SDK 2.1.181 → 2.1.202)
- [FEATURE] Path anchor prefix for the current project's metadata directory in sandbox filesystem rules
- [BUG] Prompt suggestions silently suppressed whenever the client-derived rate-limit status is allowed_warning — strict-equality gate in Vxy
- [BUG] Remote execution sandbox blocks git clone to github.com, breaking pip install of git+https:// dependencies
- [Cowork file tools silently truncate / null-pad writes on the Windows workspace mount]
- [BUG] Long-running `claude remote-control` server silently breaks after a CLI self-update — new sessions fail with EPERM while the server still reports connected
- [BUG] Cowork sandbox fails to start on macOS after June 10 app update: "Workspace unavailable... Download failed"
- [BUG] No supported way to disable only the context_management beta — breaks Claude Code on HIPAA-flagged orgs without ZDR (first-party Anthropic API)
- [Feature Request] macOS sandbox: auto-manage allowMachLookup for TLS/system services
- [BUG] Cowork VHDX placement fails with ELOOP on Intel RST VMD Controller 467F — distinct from EXDEV, bash permanently broken since v1.8089.1
- [BUG] Security: permissions.deny rules not working
- [BUG] IS_SANDBOX=yes and port 27017 blocked on "Full" network access cloud environment
- Hosted GitHub MCP OAuth flow broken in claude.ai/code web sessions
- [BUG] SANDBOX ERROR CODE ENOSPC: no space left on device,
- Long-running synchronous MCP tool calls (>~10–12 min) trigger 'session stopped responding' UI watchdog and orphan MCP server processes
- [BUG] Edit/Write tools fail with EPERM on Windows drive root paths (e.g. D:\)
- [Bug] Agent executes destructive database operations without confirmation, causing data loss
- Sandbox bind-mounts /dev/null device nodes in working directory, breaking Python build tools
- [BUG] Claude code freezes when running in sandbox (WSL)
- [BUG] claude --continue aborts on Linux 2.1.120 with `sandbox required but unavailable: ${j$}` (unfilled template literal)
- sandbox.enabled: false ignored at runtime; allowWrite emits doubled path prefix (2.1.116)
- [BUG] EXDEV on MSIX workspace setup (rootfs.vhdx rename fails) - Win32 workaround from #48362 no longer exists, no fix available
- bwrap launcher uses --bind for optional hardware paths (/opt/cuda*); fails on systems without CUDA installed
- Auto mode hangs silently when a tool call is rejected by sandbox/permissions
- [BUG] Cowork tab missing — yukonSilver misdetection, build 1.3109.0, Windows 11 MSIX
- [BUG] Cowork: "Failed to create bridge sockets after 5 attempts" on every session since 1.3036.0 (macOS 26.3.1)
- [BUG] Code 1
- [BUG] Claude commands fail with EACCES permission denied error when creating files
- Scheduled tasks fail with 'useradd: cannot create directory /sessions/...' RPC error
- [BUG] Error text color too dark on dark terminal backgrounds
- Bundled ripgrep binary loses execute permission on macOS (breaks command/skill discovery)
- [MODEL] Opus 4.6 deleted a git worktree that was actively being used by another claude code session
- [BUG] Claude Agent in Xcode downloads ARM64 binary on Intel Macs, x64 binary rejected due to code signing
- Plugin deployment strips execute bit from hook shell scripts
- [Windows] Background agent output file stays 0 bytes due to symlink permission failure
- Plugin marketplace sync drops execute permissions on .sh files
- Include sandbox state in hook input JSON
- [BUG] dangerouslyDisableSandbox bypasses sandbox without prompting in auto-allow mode
- Desktop app cannot start sessions in ~/Library/CloudStorage (OneDrive/iCloud) paths
- [BUG] Claude Code uses Linux sandbox (bwrap) instead of macOS Seatbelt when bwrap is installed via Homebrew (Apple Silicon, v2.1.71)
- Managed settings deny rules from Console not enforced (remote-settings.json)
- Claude Desktop: disclaimer helper blocked by macOS quarantine - local sessions crash with 'Operation not permitted'
- [Bug] Concurrent config writes corrupt `.claude.json` on Windows startup
- Agent SDK: prompt cache invalidated every query() — random UUID in Bash tool description
- [BUG] Cowork – Virtualization Not Detected on Dell XPS 14 9440 (Windows 11 Pro)
- [DOCS] Permission rule evaluation docs don't match observed behavior (deny → ask → allow precedence)
- [BUG] Cowork Windows - sandbox-helper fails to mount host share (virtiofs/Plan9) with OneDrive-synced folders
- [DOCS] Plugin authoring guide should warn about plugin.json name collision with marketplace name
- [BUG] Claude Code bash tool fails on HPC/SLURM compute nodes
- [Bug] Plugin installation installs all skills instead of selected plugin only
- [Bug] Ctrl+C unable to interrupt long-running Bash commands
- Task tool subagent spawning ignores TMPDIR, hardcodes /tmp/claude/
- [BUG] gradle being blocked by sandbox even though it's dir off of ~ is in the allow list
- [Bug] 80% usage in 2 days - Rate limit usage display shows incorrect percentage for current week/session - Max x20 $200/mo
- [BUG] Termux: Background tasks fail with malformed path - HOME sanitization breaks on deep paths
- [BUG] Glob fails silently when ripgrep hits permission denied on any subdirectory
- [BUG] Shell initialization (cd ~ in .bashrc) breaks workspace boundary
- [TypeScript V2 SDK] Tool execution requires approval despite permissionMode: 'bypassPermissions' and allowDangerouslySkipPermissions: true
- [BUG] Execution of Deny permissions in settings.json
- [BUG] Inline command execution (!`cmd`) in slash commands fails with permission error
- [BUG] Error: EPERM: operation not permitted, uv_cwd
- claude plugin eval: every Bash call fails on stock Ubuntu (apply-seccomp setgroups, #43454) and the sandbox settings workaround cannot be applied
- [FEATURE] Mods: a pane element that renders a local web page (WebView), no server needed
- [DOCS] HTTP_PROXY env var can also be used to redirect sandbox traffix
- [BUG] Sandboxed Bash tool blocks .git writes (refs/heads, index.lock) despite filesystem.allowWrite/excludedCommands overrides